CVE-2026-92469
microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check
CVSS 4.0 7.2 HIGHCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92469
Publishedzlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metadata by supplying their identifiers to the delete endpoint.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92469 · CVE overview and exploitation status
cve-program · CVE-2026-92469
- https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java#L48
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C19_delete_any_file.py
- https://github.com/zlt2000/microservices-platform
- https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-arbitrary-file-deletion-via-missing-ownership-check
Related changes
Linked by CVE identifierNo related changes are available here.